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Abstract 

The study of quantum cryptography and quantum entanglement has traditionally been based 
on twodevel quantum systems (qubits) and more recently on threedevel systems (qutrits). We 
investigate several classes of state-dependent quantum doners for fourdevel systems (quartits). 
These results apply to symmetric as well as asymmetric doners, so that the balance between the 
fidelity of the two clones can also be analyzed. We extend Cerf 's formalism for cloning states in 
order to derive cloning machines that remain invariant under certain unitary transformations. Our 
results show that a different doner has to be used for two mutually unbiased bases which are related 
by a double Hadamard transformation, than for two mutually unbiased bases that are related by 
a Fourier transformation. This different doner is obtained thanks to a redefinition of Bell states 
that respects the intrinsic symmetries of the Hadamard transformation. 
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I. INTRODUCTION 



Quantum cryptography aims at distributing a random key in such a way that the presence 
of an eavesdropper (traditionally called Eve) who monitors the quantum communication is 
revealed by the errors she introduces in the transmission (for a review, see e.g. To realize 
a quantum cryptographic protocol, it suffices that the key signal is encoded into quantum 
states that belong to incompatible bases, as in the original qubit protocol of Bennett and 
Brassard known as BB84 |2j. In past years, several qutrit-based cryptographic protocols 

were shown to be more secure than their qubit-based counterparts HQ HARAS- ths 

justifies the interest for studying the security of quartit protocols (see also Ref. [10|] ) . In order 
to evaluate the security of such protocols against individual attacks (where Eve monitors the 



quartits separately or incoherently) we will consider a fairly general class of eavesdropping 
attacks that are based on (state-dependent) quantum cloning machines [ill Q H ths 



will yield an upper bound on the acceptable error rate. Higher error rates do not allow 
secure communication, since in accordance with C-K theorem jl^, a spy could in theory 
acquire all the information, if Alice and Bob restrict themselves to one way communication 
on the classical channel. 

Quantum cloning is a concept that was first introduced in a seminal paper by Buzek and 
Hillery Q], where a universal (or state- independent) and symmetric cloning transformation 
was introduced for qubits. This transformation was later extended to higher- dimensional 
systems by Werner [lq but only in the special case of a universal (state-independent) doner. 
In contrast, we will focus on non-universal (or state-dependent) doners. Our starting point, 
summarized in Sec. |TI] is a general characterization of asymmetric and state-dependent 
cloning transformations for iV-level systems, as described in Refs. Q, Q- In Sec. HTJ 
we will establish the generality of this formalism. We adapt the formalism in Sec. IIVI such 
that it is invariant under certain unitary transformations. We propose in Sec. Man optical 
implementation for quantum key distribution that generalizes BB84 protocol |2j. In this 
new protocol, the signal is encoded in four-dimensional basis states, in two mutually unbi- 



ased bases 



261 ] . The covariant cloning formalism developed in the previous sections will be 



applied in Sec. IVII to clone these two mutually unbiased bases that are actually related by 
a double Hadamard transformation ^(|. We will show that the optimal doner requires a 
generalization of the Bell states well adapted to the particular problem under study, before 



2 



we conclude in Sec. I VI II 



II. STATE DEPENDENT CLONING FORMALISM 

To explain the general cloning formalism it is convenient to look at the exchange of a 
quantum key in a different way. Suppose Alice and Bob exchange the maximally entangled 
state: 

N-1 
fc=0 

The states \k) form a basis ({|0), |1), |iV)}) (called the computational basis) in the N- 
dimensional Hilbertspace. Alice has access to the first quantum, while Bob has access to the 
second. If Alice now projects her part of the state on the resulting state is: 

N-1 N-1 

(mm ® /) E ^ ® ^ = E^*i fc > ® ^ 

k=0 i=0 

N-1 

= iv>X)w>®i fc > = i^>®i^> ( 2 ) 

i=0 

The result is a product state, and Bob has access to \ifj). We see that it makes no difference 
whether Alice creates and sends the state to Bob, or whether Alice projects her part of a 
shared maximally entangled state on Therefore, we will use this representation of the 
exchange of as it makes the mathematical description of doners more elegant. A spy's 
attack would now consist of modifying the maximally entangled state when it was created 
or exchanged. 



In the cloning formalism of N. Cerf 
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12 . Il3| , the maximally entangled state is modified 



into the N 4 dimensional state |\I/)r,a,b,c- The index 'R' denotes the reference state accessible 
to Alice. She will project it onto to communicate with Bob (as she doesn't know Eve 
has tampered with the maximally entangled state, she thinks that Bob will receive The 
index 'A' denotes the state that is accessible to Bob, and it will contain the first (imperfect) 
clone of The index 'B' denotes the state of Eve that will contain the second clone. 
And finally 'C is the state of the Cloning machine, and is also accessible by Eve. In the 
formalism of N. Cerf, \^)r ) a,b,c has the form: 

N-1 N-1 
\^}r,A,B,C = ttm^n \B m ,n) R,A\B m -n) B,C = ^>m.n \B m ,n) R,B\B m -n) A,C (3) 



m,n=0 m,n=0 



The states \B m>n ) are generalized (Fourier) Bell states denned as |27j : 



N-l 



\B m , n ) RA = N- 1 ' 2 e 2m(kn/N) \k) R \k + m) A (4) 

fc=0 

In (PJ), a m)n and h m ^ n are normalized complex amplitudes: 

N-l N-l 

^ ^ I ^777,77 1 ^ ^ | ^777,77 1 1 (5) 

m,n=0 m,n=0 

We can easily calculate the inproducts of the basis states: 

((B m ,n\R,A (B m - n \ B ,c) (\B x>y ) R:B \B x - y ) A ,c) = N' 1 exp (^{nx - my)) (6) 

Using (jB)) and Q , we can easily show that a m ^ n and b m ^ n are dual under a Fourier transform: 

1 

_ _±_ ST^ 27Ti(nx-my)/N h ( ? \ 
u >m,n / j ° "a;,?/ V ' / 

x,y=0 

N-l 

b m ,n = ^ E e 2m{nx ~ my)/N a x , y (8) 

x,i/=0 

Projecting the reference system of \^)r,a,b,c onto yields (using (j3J): 

N-l N-l 
a ^,n U mtn \^) A \B 

m,—n )b,C — ^m,ra Um^lp) b\ B m ,—n )a,c (9) 

777,77=0 771,77=0 

with: 

N-l 

U m , n = J2^ l{kn/N) \k + m)(k\ (10) 

k=0 

The error operators £/ m>n shifts the state by m units (modulo iV) in the computational basis, 
and multiplies it by a phase to shift its Fourier transform by n units (modulo N). Of course, 
Uq,o — I, which corresponds to no error. Note that: 

(J® U mtn )\B Q<0 ) = | B m>n ) (11) 

The state © completely characterizes the cloning transformation . To evaluate the 
quality of the clone A (B), we take the partial trace of over 'B' and 'C ('A' and 'C') of the 
density operator associated with state 0. The resulting reduced density operator p A and 
Pb of respectively the first and the second clone are: 



N-l 



PA = 22 \ a m,n\ 2 \^m,n) {lpm,n\ (12) 

777,71=0 
N-l 

PB = ^ |^m,n | 2 | VVn) (^,77 1 (13) 



777,77=0 



4 



where 

\ip m ,n) = U m>n \ip) (14) 

The fidelity of the first clone when copying (i.e the probability that there is a collapse 
onto this state) is equal to 

N-1 

F A = (lp\p A \lp) = ^ l a m,n| 2 |(V#m,n)| 2 (15) 
m,ra=0 

Focusing on the computational basis, we see that the fidelity of any state \k) is equal to: 

N-1 

f a = j2m 2 (i6) 

n=0 

We also define N — 1 disturbances: we call Di the probability that there is a collapse on 
\k + i) if state \k) was sent. The disturbances are (in the computational basis): 

N-1 

A = X)k«| 2 with i G {1, 2, ... TV — 1} (17) 

n=0 

The fidelities and the disturbances of the second clone are obtained by replacing a m , n with 
b m , n m f|T3j) - (fTTj) . It is clear that the quality of the two clones depends on the amplitudes 
a min and 6 m>n . Furthermore, there is a trade-off between the quality of the two clones. 
Suppose a m ^ n is a peaked function (i.e a m n is large for one value of {m, n} and small for the 
other values) leading to a high-fidelity of the first clone. As b m ^ n is the Fourier transform of 
a m)n it will be a rather flat function (i.e. all b m ^ n will be almost equally large), leading to a 
rather low fidelity for the second clone. [29] The balance between the quality of clones A and 
B can be expressed, in full generality, by an entropic no-cloning uncertainty relation that 
relates the probability distributions p m>n and q m ^ n [13l |: 

H[p] + H[q}>log 2 (N 2 ) (18) 

where H\p] and H[q] denote the Shannon entropy of the discrete probability distributions p 
and q defined as 

p(m,n) = |a m , n | 2 (19) 
q(m,n) = |6 m , n | 2 (20) 



This inequality is actually a special case of a no-c 
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oning uncertainty relation involving the 
. More refined uncertainty relations can 



losses of the channels that yield the two clones 
be found that express the fact that the index m of output A is dual to the index n of output 
B, and vice versa jl^ ]. 



III. ABOUT THE GENERALITY OF CERF'S FORMALISM 



One could object that the class of cloning machines considered in this paper is not the 
most general one. Indeed, we postulate from the beginning that the joint state \^)R t A,B,c 
has the form of Eq. (J3J) implying that the reduced density matrices of Alice and Bob (R, A) 
and Eve (B, C) are diagonal in the Bell basis. Although Eve is free to choose the basis that 
diagonalises her reduced density matrix, the most general state \^)r,a,b,c wm n °t possess the 
property that TrB,c\^)R,A,B,c{^\R,A,B,c is diagonal in the Bell basis \B mjn )R t A- We will call 
the states that have this property "Cerf'-states. Nearly all the (optimal) cloning machines 
tha t appea red in the literature can be unambiguously represented by a Cerf-state 
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21 1 . We can guess the underlying physical reason if we note that the Bell states are 
invariant (up to a global phase) under a cyclic relabeling of the basis states. Indeed, let us 
consider the generator C of cyclic permutations of the indices / of the computational basis: 

C.\l) = + mod 4) (21) 

It is easy to check that the Bell states defined in Eq. Q are mapped onto themselves 
under such a permutation (up to a global phase), and under all its powers. So, when cyclic 
permutations are a natural symmetry of the protocol, it is also natural that the Bell states 
defined in Eq. (J3J) play a privileged role in Eve's attack: the symmetries of the effects reflect 
the symmetries of the causes as is well known in physics. 

Now, we could ask the inverse question: "What is the most general state that is invariant 
under any cyclic relabeling of the basis states?" We shall show that when optimal qubit 
cloning machines are described by a 2 4 dimensional pure state which is invariant under any 
cyclic relabeling of the basis states, such a state is a Cerf state. This shows (at least for 
qubits) that Cerf's formalism for optimal cloning machines is more general than it could 
seem at first sight. 

In two dimensions, only two permutations exist: the identity and the generator C that 
switches the labels and 1 (which is a parity operator: C 2 = 1). We shall now prove the 
following theorem: 

Theorem: 

Let us consider any qubit protocol. Let us consider the corresponding 16 dimensional 
pure state that is assumed to be optimal and to be invariant under any cyclic relabeling of 
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the basis states. Such a state is a Cerf-state so to say Tr R ,c\^) r,a,b,c(^\r,a,b,c is diagonal 
in the Bell basis \B m ^ n ) Ri A- 
Proof: 

The four Bell states, when N = 2, are defined as follows: 

|S 0)0 ) = -L(|00) + |11)) \B lfi ) = -L(|01) + |10» (22) 

\B ,i) = -^=(|00> - |11)) \B 1A ) = -L(|01) - |10» (23) 

It is easy to check that the Bell states are eigenstates of the permutation operator C with 
the eigenvalues ±1. If we impose that the joint state \^)r,a,b,c is invariant under the action 
of the permutation operator (C\^/) R) a,b,c — \^)r,a,b,c )> then it belongs necessarily to the 
8 dimensional eigenspace associated to the eigenvalue +1 of C: 



\^)r,a,b,c = a+ 


\Bo,o)r,a ® 


\Bo,o)b,c + OL. 


-\Bo,i)r,a <8 


1 |-Bo,i)s,c 




+P+ 


|-Bl,o)i?,A ® 


|-Bi,o)s,c + 


■I-Sij)^ ® 


-Bi,i)b,c 




+7+! 


Bi,q)r,a ® 


-Bo,q)b,c + 7- 




-So,i)s,c 






Bq,o)r,a ® 


|-Bi,o)b,c + <5- 


l-Bo,i)fl,A ® 


-Sl,l/B,C 


(24) 



We see that the requirement that the full state is invariant under a permutation of the basis 
states reduces the generality of the joint state (which is usually described by 16 amplitudes). 
Here the amplitudes associated to states that are antisymmetric under the action of the 
permutation operator C are assumed to be equal to zero. Although Eq. (jUJ) does not yet 
describe a Cerf-state, we shall proof that in the optimal case it does. In order to do so, let 
us first consider the reduced state shared by Alice and Bob: 

Pr,a =Tr B:C \^) RjA:B: c(^\R,A,B,c 

={a + \B 0i0 ) R)A + i+\B 1>0 ) R>A )(a* + (Bo t o\ RtA + J+(B 1;0 \r,a) 
+{P+\Bi t o)R,A + $+\Bofl) r,a)(PX(Bi,o\r,a + 5+(Bo t o\li s A) 
+ (a-\B A)R,A + 7- l-Bi.i)^) (al(B 0i i\ Ri A + 7-(- b i,iUa) 
+{I3-\Bi,i)r,a + 5^\B a)r,a)(P1(B 1 a\r,a + £<£o,ikx) ( 25 ) 

It is worth noting that the non-diagonal components of the reduced density matrix p Rt A of 
the type \B it j)(B mtn \ (for i 7^ m) do not contribute to the statistics of the measurements 
performed by Alice and Bob in the computational basis. Indeed: 



{pq\B id )(B m , n \pq) = X - J2(-l) kj+ln (p\k)(q\k + i)(l\p)(l + m\q) (26) 

k,l 
k,l 

= \{-l)^ +n) 5 q , p+l 5 q , p+m (28) 

which is if m ^ i. This means that everything happened, from the point of view of Alice 
and Bob, as if p^,A was equal to the effective density operator p^J A defined as: 

pf A = (|a + | 2 + \5 + \ 2 )\B 0fi )(B 0fi \ + (I/3+I 2 + |7+| 2 )|£i,o><Bi,o| 

+ (M 2 + \d^\ 2 )\B 0)1 )(B 0>1 \ + (|/?_| 2 + | T _| 2 )| J B 1)1 )( J B 1)1 | (29) 

Let us evaluate the information possessed by Eve relatively to Alice. We denote the 
probability that Eve simultaneously observes the output clone B to be in the i th detector 
and the cloning machine C in the j th detector and Pj^\ E the probability that Alice's k th 
detector fires while Eve simultaneously observes the output clone B in the i th detector and 
the cloning machine C in the j th detector. By direct computation, we obtain that: 

Po E o =*?x = ^(Kl 2 + l«-! 2 + l7 + | 2 + l7~| 2 ) (30) 
Po,i =Pi E o = \(M + \P~\ 2 + \h\ 2 + |5-| 2 ) (31) 

p A;E _, _ p A;E _ , _ p A;E _ p A;E 
- r 0;0,0 ~ L r l\0,0 ~ 1 ^0,1,1 ~ r l;l,l 

=\p E o + lM*+ ■ at) + ^Re( 7+ • H) (32) 

p A;E _ p A;E _ _ p A;E _ p A;E 

*0;0,1 ~ L ' r l;0,l ~~ 1 M);1,0 ~~ ^1;1,0 

=±P* + \Re((3 + ■ (31) + ±Re(5 + ■ 61) (33) 

Equations ()30fJ3*3*j) show that the information gained by Eve during such an attack is certainly 
not superior to the information gained during an attack in which Eve chooses the Cerf state 

1 

+[3+\B 1i0 )r,a ® \B 1<0 ) B ,c + P-\ B hi)RA ® \Bx,x) B ,c) (34) 



(a+|S 00 )fl,A ® \B q ,o)b,c + Oi-\Bo,i) R ,A ® \B ,i)b 



c 
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with probability P\ = |a + | 2 + |a_| 2 + \(3+\ 2 + \/3-\ 2 and the Cerf state 




(7 + |-Bo,o}ft,A ® \B ,o)b,c + 7-l^o,i)i?,A ® |-B ,i)b,c) 



+5+|5 1i0 )r,a ® |Bi,o>b,o + ^-|-Bi,i>fl,A ® |5 1 ,i) B ,o) (35) 

with probability P 2 = |7+| 2 + |7-| 2 + |<5+| 2 + 1^-1 2 • Furthermore, the two attacks lead to 
the same distribution of statistical results, as the effective density operator (|29~|l equals the 
density operator of the attack using (JMj) and (|35|). By assumption, the optimal (pure) Cerf 
state is superior to this second attack (which uses a mixture of Cerf states), which ends the 
proof. The generalization of this proof to arbitrary dimensions is given in |22|. 



IV. THE CO VARIANT CLONING MACHINE 



The formalism defined in the previous section is valid when Alice and Bob re- 
spectively encode and measure the signal in the computational basis (|0), |1), |2)...|iV)). 
Quantum cryptographic protocols impose that Alice must use at least another basis if) 
(l^o), |$a), • • • with 

m) = A v (36) 

If Alice and Bob share the joint state |-E?o,o) and that Alice wishes to encode the signal in 
the if) basis, she must project her component of \B Oj0 ) into the conjugate basis (that we shall 
from now on denote the if)* basis) defined as follows: (i\if)*) = A*-. This property is a direct 
consequence of Eq. (J2J). We now require that the computational basis is not privileged, and 
that the cloning machine clones the states of the computational and the if) basis in the same 
manner. This implies that after projecting the reference (Alice's) system onto the state \if>*) 
(which would result in an input state \if>) of Bob, in the absence of an eavesdropper), the 
reduced density operators of Bob and Eve must be of the form: 

N-l 

PA = ^ Pm,n\^m,n) {^m,n\ (37) 
m,n=0 
N-l 

PB = ^ 9W>IVW) $m,n\ (38) 
m,n=0 

where 

\i>m,n) = U m , n \lf)) (39) 
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and 

JV-l 



U m ,n=Ys e2m[kn/N) \^+™)^V ( 40 ) 
k=0 

A possible corresponding joint state of the two clones and the cloning machine is (see also [^]): 

N-l N-l 

E am < n Um,n\lp)A\B^ n )B,C = E bm ' n Um,n\^) B\B* m ^ n ) A,C (41) 
m,n=0 m,n=0 

where 

N-l 

\B m ,n) = N- 1 ' 2 e 2 ^ kn ^\rM k+m ) = (I® Ej ro , n )|fl ,o> (42) 

fc=0 

Equation (}4"2*)) is a generalization of the Bell States defined in (j3J). Indeed, if is the 
computational basis, (|42|) and are equal, because the computational basis is real and 
\Bmn) = \B m ,-n)- The joint state of the reference R, the two output clones (A and B), and 
the (iV-dimensional) cloning machine C that corresponds with (}4"T]) is: 

N-l N-l 

E a m,n \B m ,n )R,A\B*m, n )B,C — E b rn,n \B m ,n) R,B\B m ^ n 

)a,c (43) 

m,n=0 m,n=0 

With this choice (^J, the requirement of covariance in the computational and the ip bases 
imposes the extra-constraint: 

N-l N-l 

)R,A\ B *m,n)B,C ~ E (Hj R,a\^W B,G (44) 

m,n=0 ij=0 

As the -B m>n states form an orthonormal basis, we can write: 

JV-l 



E am,n\B m , n ) RA \B 

m,n B,C 

m,n=0 

= E°M (E l^n}(5 m , n | J ISy)^ (E KlX^ll ) (45) 
ij \m,n / \ / 

Defining: 

Kj,A,i=(Svil4,i) (46) 
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we get: 

<bn,n$(m,n),(k,t)\Bm,n) l^A\Bk,l) B,C (47) 



m,n 
k,l 



0"i,j\ B rn,n) R,A V m,n,i,j\B* kl ) BfiV^l^ij (48) 



l,m,n 

= ^%j),(p,5)Ki,»,tj^ )M |5 min )^|S^) S)C (49) 

m,n,i,p 
j,k,l,q 

Formally, this constraint can be expressed as a matrix relation: 

VA = AV (50) 
where V and A are N 2 xN 2 matrices defined as follows: 

Vm,n;i,j = Kn,n,i,j (51) 

and A the diagonal matrix defined as 

-Ai,j;p,q = a ij3{hj),(p><]) (52) 
As A is diagonal, (J5U|) is extremely simple to solve: 

if Vij ;p ,q 7^ then a id = a Ptq (53) 

Therefore, to build a cloning machine that is invariant in two bases (the computational 
basis and the ip basis) we only need to compute the N 4 inproducts Vij-^i = (Bi,j\Bk,i)- The 
solutions a m>n of Eq. (|53|) define the most general cloning machine that is invariant in the 
two bases. 

The generalization in the case where none of the bases is the computational basis is 
straightforward. The condition (J53)l remains valid, as long as we construct the Bell states 
using (}4*2|) for the two bases. 



V. QUANTUM CRYPTOGRAPHY WITH TWO COMPLEMENTARY QUAR- 
TIT BASES: A PROTOCOL BASED ON INTERFEROMETRIC COMPLEMEN- 
TARITY. 

A quantum protocol for key distribution that implements quartit states can be conceived 
using the lateral shape of electromagnetic pulses. Consider figure [T] Each 0y represents the 
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FIG. 1: Rectangular Array of pulse shapes 



same (lateral) field distribution, shifted in its own square, and coherent with respect to the 
others. In theory any distribution could be used, as long as two neighboring distributions do 
not overlap. In practice, these can be easily produced by a fan-out of a single laser source. In 
combination with an external modulator, that can switch off or switch on each channel, and 
a controllable 7r-phase retarder, we can easily realize the following two mutually unbiased 
bases: 



|0> = i (|0n) + |0i2)) |1> = — (|0n) - |0i 2 )) 
|2> = 



1 
1 



^(l<M + |<M) |3> = -^=(i0 21 )-|02 2 » 



(54) 



and 



|0'> 



^(I0u> + I02i» |i / ) = -^(K)-K)) 



|2'> =^(|012> + 1022)) |3') = ^(|012) 



1022)) 



so we have : 



A |2 



(i\f)\ 



1 

4 



(55) 



(56) 



If we represent the in-products between the first basis and the second one in a matrix form, 
we get: 



H, 



,, -«*!/)) = 2 



(57) 



/ +1 +1 +1 +l\ 
+ 1 +1 -1 -1 
+1 -1 +1 -1 

V+i -l -l +i / 

Actually, this is (up to a permutation of the second and the third primed basis states) a 



double Hadamard transform 
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231 ] . The simple Hadamard transform is well-known in 
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Mirror 



/ 



FIG. 2: Possible measuring apparatus, distinguishing between |0) and |1). The distances of 
the mirrors are tuned in such a way that in the horizontal (vertical) arm there is constructive 
(destructive) interference 



quantum information 



2J: it sends the qubit \i) (i=0, 1) onto ^jflO) + (-) i |l)). It is easy to 
check that if we identify the computational quartit basis with the product basis as follows: 
\ quart} = | qo) , | l<?« art ) = 1 10) , 1 2 quart ) = |01), and |3« uar *) = |11), then, when the qubits 
undergo a simple Hadamard transformation, quartits change according to Eq. (joT|) (up to a 
permutation of the labels 2 and 3 of the primed basis). 

Therefore we shall from now on call it a Hadamard transform, and denote its elements Hij 
in accordance with Eq. (joT|) . FigureEJshows a relatively simple setup, consisting of a mirror, 
a 50/50 beam splitter and two photon counters, which can distinguish between the states. 
The mirror's position is tuned to ensure that if two distributions enter the device, their fields 
are added in the horizontal branch and subtracted in the vertical one. So if we position the 
two input lines of this interferometer in the (fin and (fiu channel, the photon counter in the 
horizontal(vertical) branch corresponds to a projective measurement on |0)(|1)). In a similar 
way, and by rotating the setup (or the incoming channels) projections on the |z')-basis can 
be made. 
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VI. ESTIMATION OF THE SAFETY THRESHOLD. 



A. Applying the covariant formalism to Fourier complementary bases 

We will now apply the covariant formalism to find a doner that clones equally well two 
quartit bases, that are Fourier transforms of each other. Cloning between such bases has 
been studied in the paetQQ. We would like to compare the results of our covariant doner 
with the optimal doners of the literature. We have the computational basis{|0), |1), |2), 
|3)} and its Fourier transform \k') = \ Y^j=o e2m<yk ^'^\i)'- 

|0') = !(|0> + |1} + |2> + |3» 
|l') = |(|0)+i|l}-|2)-ii3)) 
|2 / ) = KlO)-! 1 ) + |2)-|3)) 

|3') = ±(|0>-*|1>-|2>+.|3» (58) 

The \k') basis plays the role of in Sec. IIVI We denote the unitary transformation that 
connects the two bases as F: 



F k>l = (k\l'} = I e 2 ™ fe ' /4) = \% kl 

(l 1 1 l\ 

1 % -1 -i 
1-1 1-1 

\ 1 —2—1 % ) 

Calculating the 16 x 16 matrix Vi J ;fc j /(we write \k) = \k')): 

~^m,n\k,l \-^m,n I -^k* ,l) 
3 

= I exp (^f ((]/ -pn)) (p\q*)(p + m\q + k) 

p,q=0 
3 
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(ql~pn) j^-pqj{p+m)(q+k) 



p,q=0 



p=0 q=0 



(59) 



(60) 



(61) 
(62) 

(63) 

(64) 
(65) 
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Remember that all additions are modulo 4. Applying (|53|) we get the condition: 

flm,n = cik,i if I + m = and k = n (66) 

leading to: 

«01 = a 03 = a 10 = a 30 a 02 = ^20 (67) 

021 = «i2 = a 23 = a 32 a u = a 13 = a 33 = a 31 (68) 

This corresponds to the following a mn matrix: 

( a b c b\ 
b d f d 

{a m , n ) = (69) 
cfef 

\b d f d J 

If we desire to optimize the information of Eve, conditioned on Alice and Bob's observations, 
this means that certain conditions of constructive interference must be fulfilled. Moreover, 
the disturbances must be the same because the transmission line is assumed to be isotropic. 



This leads eventually 



22| to the condition that b = c and e = /. So the a mn matrix that is 



covariant in the two Fourier bases becomes: 



/ x y y y\ 

y z z z 
y z z z 
\y z z z) 



(70) 



which leads to the cloning state: 



\V)r,A,B,C = V a m ,n\ B m,n) R,a\ B III, 1 1 B,C 
m,n=0 

3 

=(v -2x + y)\B 0i0 ) RtA \B 0i0 ) Bt c + (x-y)^2 \ B o,n) r,a\ b I,u) b,c 

n=0 

3 3 

+ ( X ~ V) I -^"1,0) ^1^771,0)5,0 + V ^2 \ B m,n) R,A\ B m,n) B,C 

m=0 m=0 

Actually, it is easy to check p] that, according to Eq. 

I B m,n )r,A — i nm \ B -n,m) R,A 

\B* )nr = i +nm \B* ) Rr 



(71) 

(72) 
(73) 
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There exists thus a bijective relation between the Bell states expressed in the computational 
basis and those expressed in the Fourier basis. It helps to understand the invariance of the 
state \^)rabc 111 D °th bases. Thanks to this bijective relation, it is easy to show that: 



\Bq,o) -mJ-Bq,o) b,c — \Bq$) r,a\Bqa) b, 

3 3 

^ \ Bo,n)lt,A\Bt >n )B,C = ^ \Bm,o)R,A\Bm,o)B, 
n=0 m=0 
3 3 

/] \B m fl) R,A\B* m fl) B,C = /J \Bo,m) R,A\Bo,m) B, 



m=0 
3 



m=0 
3 



2j \Bm,n) R,A\B* m , n ) B,C ~ I B m ,n) RA \ B^ n ) B ,C 



m=0 



m=0 



A cloning machine with such a matrix was already studied in 5| , although in that case the 
authors proposed the matrix without the covariant demand. The optimum of this doner 
(in four dimensions) and in the symmetric case (i.e. the doner produces two clones of the 
same quality) is characterized by (5, 25]: 

/3 1 1 l\ 



1 I I 1 

333 

1 I I I 

333 



(74) 



The two clones have a fidelity of 

and the three disturbances (error rates) 

D 1 = D 2 = D 3 



1 

12 



(75) 



(76) 



As the three Disturbances are always equal with the matrix (fTHjl . the maximum fidelity will 
also be the maximum of the mutual information between Alice and Bob (or between Alice 
and Eve for the second clone): 

Iab = Iae = 0.792 (77) 

A theorem of Csiszar and Korner Q| shows that a secret key with R bits can be generated 
through privacy amplification if: 

R>Iab~ Iae (78) 
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It is therefore sufficient that Iab > Iae m order to establish a secret key. If we restrict our- 
selves to one-way communication on the classical channel, (J78j) is also a necessary condition. 
Therefore, an error rate of 25% is the maximum that can be allowed between Alice and Bob. 

As we noted in section IIII1 the Cerf states are invariant under any cyclic permutation 
of the labels of the basis states. Actually, the invariance under cyclic permutations of the 
indices of the computational (Fourier) basis plays a fundamental role in this approach. For 
instance, it is easy to check that the Bell state \B m ^ n )xy is obtained by projecting the state 
|0, m) onto the eigenspace of C associated with the eigenvalue i~ n (C is defined in Eq. (f2*T|)). 
This projector is equal to 

4-1 1 4-1 

J2\ B kn)(B kn \ = -^ nk C k (79) 

k=0 k=0 

where we made use of the fact that C 4 = C° = 1. Beside, one can check that the same 
Bell state, when it is expressed in the product bases \ipk)\ipk'*) (and \ipl)\ijjk') ) is invariant 
under cyclic relabeling of the indices k, k! of the type k, k' — > k + 1, k' + 1 (let us call these 
permutations C and C), for the eigenvalues i m and i~ m respectively. We shall generalize 
this property in a forthcoming section. 



B. Estimation of the safety threshold in the usual formalism. 



\0"m,n) 



(80) 



Let us now study the security of the protocol based on interferometric complementar- 
ity using the covariant cloning machines described in the previous section. The condition 
(Vi,j-,k,i 7^ 0, then Ojj = ak,i) yields the a mn matrix: 

( a b c b\ 
b d b d 
c b e b 
\b d b d ) 

The associated matrix b mn that we obtain according to Eq. (JEJ) is: 

/ a + 8b + 2c + 2d + e a — e a — e a — e \ 

a — e a — 2c + e a — e a — 2c + e 

a + 2c — 4d + e a — e a — 46 + 2c + e a — e 

\ a — e a — 2c + e a — e a — 2c + e J 



(81) 
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According to Eq. (fTBj). one can check that the fidelity associated to such a cloning state 
is equal to Fa = \a\ 2 + 2\b\ 2 + \c\ 2 . Let us define the disturbance D\ {% — 1,2,3 ) as the 
probability that when Alice measures the state \j) , Bob measures the state \j + i). It is 
easy to check that 

2V-1 



n=0 



As the transmission line is usually considered to be isotropic, we have D\ = D\ = D A , 
yielding the condition that 2\d\ 2 = \c\ 2 + |e| 2 . The cloning state defined by the following 
matrix obviously fulfills these constraints: 

( a b c b\ 

b c b c 



(a %so \ 



c b c b 
\b c b c J 



The fidelity and disturbances are: 



(83) 



U A 



A 



F l A so = |a| 2 + 2|fr| 2 + |c| 2 
2|fe| 2 + 2|c| 2 



T~\iso3 
U A 



(84) 
(85) 



The associated matrix 6^° that we obtain according to Eq. ( 

f a + 8b + 7c a — c a — c 



(b is ° ) = - 

\ m,n/ j 



a — C 
a — c 
a — c 



a 



c 



a 



is: 

a 
a 



-c\ 



a — c a — 86 + 7c a — c 
a — c a — c a — c J 



with a fidelity: 



T-llSO 



(86) 



2| 2 + 2|6| 2 + |c| 2 (87) 

We can now maximize Fg° for a given F l A so . This is shown in Fig. El For a "symmetric" 
doner a fidelity of F A so = Fg° = 0, 7018 is obtained. This is significantly less than the 
limit threshold of 0,75 that was obtained bv the optimal doner that clones equally well two 
Fourier complementary bases in Ref. 0, The difference is that we are now looking at 
the cloning machine that clones equally well (and optimally) two Hadamard complementary 
bases. In order to convince ourselves that they are different cloning machines, it is useful 
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FIG. 3: Fidelity of the second clone as a function of the fidelity of the first clone. They equalize 
at F = 0.7018. 



to recall that the optimal cloner that was found in Ref. p, |y] is symmetric. If we impose 
this sy— , V. - W • * the present level, we get the universal or isotropic Coning 
machine [13J: 



"m,n ) 



( a b b b\ 
b bbb 
b bbb 
\b b b b J 
The fidelity and disturbances are: 

F= |a| 2 + 3|£>| 2 
D 1 = D 2 = D 3 = 4\b\ 2 

The second clone then has a fe m „ matrix defined as follows 



(88) 



(89) 
(90) 



(pm,n) 



/ q+15 b a—b a—b a—b \ 
1 4 4 4 4 > 



a—b a—b a—b a—b 

4 4 4 4 

a—b a—b a—b a—b 

4 4 4 4 

a—b a—b a—b a—b 

4 4 4 4 



V 



(91) 



with a fidelity of F 1 
have 
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a — b\ 2 + jq\cl + 15b\ 2 . Due to symmetry and normalization, we 



10 



4 

To 

20 



(92) 
(93) 
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Note that the fidelity of the optimal symmetric universal (or isotropic) doner in N dimen- 



sions 



13, 



is F = nfi^Arx ; which in 4 dimensions yields a fidelity of 70%. The optimal 

01 



isotropic quartit doner of 
of 73.33% according to Ref. 



, which is slightly asymmetric, is characterized by a fidelity 
and not 75% as in Eq. (JTHj) . 
It is extremely puzzling that two mutually unbiased bases that are related by a Hadamard 
transformation cannot be cloned with the same fidelity as bases that are related trough a 
Fourier transformation. We found a way to escape this paradox: it consists of a redefinition 
of the Bell states. 



C. Definition of the Hadamard Bell states 

It is worth noting that the optimal Fourier cloning state \^)rabc °f Eq. (J7TJ) is 
not invariant under arbitrary permutations. For instance x. Ylm=o \Bm$) r^B^ )b,c = 
x. Ylki 1=0 + ^)a\1)b\1 + i)c contains the component x.|0)r|1)a|2)b|3)c but not 

x.|0)^|1)a|3)b|2)c- Therefore it is not invariant under permutations of the labels 2 and 
3 of the basis states of the computational basis (note that in dimensions two and three, the 
corresponding state is invariant under such a relabeling). 

Beside, it is easy to check by direct computation that the state \^)rab c * s n °t invariant 
in the bases described in Eqs. (I54|55|) . Among others, the bijective relations described in 
Eqs. ()72|73)1 are not valid when the bases are related through a Hadamard transformation. 
This is a novelty that only appears in 4 dimensions (or in higher dimensions), because for 
lower dimensions one can show that, up to a convenient redefinition of the phases of the 
basis vectors, two mutually unbiased bases are always the (discrete) Fourier transform of 
each other. Essentially this is due to the fact that when the sum of two (three) phases cancel 
out, these phases are unambiguously defined (up to a global phase). This is no longer true 
when four phases or more are considered. 

If we want to apply the formalism for cloning machines developed throughout this paper 
in order to deal with the case of two mutually unbiased bases that are not a Fourier but 
a Hadamard transformation of each other, it is necessary to generalize the definition of a 
Bell state. In analogy with the "Fourier" cloning state \^)rabc defined in Eq. (171)1 . we 
are now looking for a "Hadamard" cloning state \^)^ a b c state that is invariant in the two 
Hadamard bases, but that is not necessarily invariant under any permutation of the labels 
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of the basis states. Moreover, we would be pleased if a bijective relation similar to those 
described in Eqs. (172173)) would relate the Bell states. 

To understand how to get the Bell-states that are suited to clone the Hadamard states, 
we have to look at the similarities between F (see Eq. (I6U|) ) and H (see equation 1)57])). They 
are both symmetric matrices, and the elements of their columns (rows) form a group with 
the product operator. Indeed we have 

2-Fjj 2F i; k = 2Fij + k (94) 

where the sum is (as before) modulo 4. We want to express the group structure of if in a 
similar way. Therefore we introduce a new 'Hadamard sum' operator: 

i © j = {i + j) mod 4 (95) 
except when both i and j are equal to 3 or 1 

1 © 1 = 3 © 3 = 1 © 3 = 3 © 1 = 2 (96) 

With this definition we can write as in (|94p: 

2Hij 2H it k = 2Hij 9 k (97) 

We have also shown in the section IVI Al that if we permute cyclically the labels of the 
computational basis, the states of the Fourier basis were mapped onto themselves and vice 
versa. This leads to the definition the Fourier Bell states: 

3 3 

B*, n = F ^° k ® ^ +m l 00 > = F k,n\k)\k + m) (98) 

k=0 k=0 

with C the operator that performs the cyclic permutation. The Hadamard states do not 
have this cyclic symmetry. But there are other permutation symmetries in this case. We 
define three permutations in the computational basis (the same permutations in the primed 
basis are noted with a prime): Pi switches <-> 1 and simultaneously 2 «-> 3, P<i switches 
«-> 2 and simultaneously 1 «-> 3 and P3 switches «-> 3 and simultaneously 1^2. Together 
with the identity (we will call Pq = I) these permutations form a commutative group. It is 
obvious that Pj (P/) maps the basis states of the primed (non-primed) basis onto themselves 
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(up to a global phase). Completely analogous with (|9*S]l we define the Hadamard Bell states: 

3 3 

K,n = Yl Hk ^ Pk ® P ^m\00) =J2 H k,n\k)\k® m) (99) 
fc=0 fc=0 

The 16 Hadamard Bell states are contained in the following list. They form a maximally 
entangled orthonormal basis, and have still all the interesting properties that characterize 
Fourier Bell states (complementarity between Eve's and Bob's reduced density operators, 
interpretation of the cloning state in terms of error operators, . . . ) as we shall show soon. 
The parities under the permutations Pi, P3, P{, and P3 are given in parentheses for each 
state. 



I^o.o) = 


^(|00) + |11) + |22) + |33))(+ + +'+') 


> \ B 0,l) 


-5« 


|00) + 


[H> — 


|22) - 


|33>) 


(+ 


- +'+') 


1-80,2) = 


i(|00>- |11) + |22)-|33»(- -+'+') 


> \ B 0,3) 


-i« 


[oo> - 


|H>- 


|22) + 


|33>) 




+ +'+') 


l*?0> = 


i(|01) + |10) + |23) + |32))(+ + +'-') 


,\B&) 




|oi) + 


|10>- 


|23) - 


|32» 


(+ 


~ +'-') 


1*5.) = 


1(|01)-|10) + |23)-|32))(- -+'-') 


1 \ B i,3) 




|01>- 


[io> - 


|23) + 


|32>) 




+ +'-') 


\ B 2fi) = 


I(|02) + |20) + |13) + |31))(+ + -'-') 


> \ B 2,l) 




|02) - 


|20) + 


|13>- 


|31» 


(+ 




\ B 2,2l = 


i(|02) + |20)-|13)-|31))( '-') 


> \ B 2,3) 




|02) - 


|20) - 


|13) + 


[31» 




+ -'-') 


\ B 3fl) = 


I(|03> + |30> + |12> + |21»(+ + -'+') 


1 \ B 3,l) 


"i« 


|03>- 


|30) + 


|12>- 


|21» 


(+ 


- -'+') 


\ B 3,2) = 


i(|03>-|30)-|12) + |21»( '+') 


> \ B 3,s) 


"5« 


|03) + 


|30) - 


|12>- 


|21» 




+ -'+') 



(100) 



We can now easily show that we have a bijective relation similar to (J72I73|) : 



|pg> = ^tf w |M©0 



1=0 

3 3 

m',p) = E 2 B i,jHi,mHi, p Hi yP \m ,p) 

k,l,m,p=0 k,l,m,p=0 
3 3 

E HpjHij&mHiplm'jp') = E 5 P j (Bm H i , p \m! ,p') 

l,m,p=Q m,p=0 
3 3 

2J H itj(Bm \m', (j © m)') = E 2Hi,jHi,m\m' ', (j © m)') 



m=0 



m=0 



iP2> = 2# M .|p/y> 



(101) 

(102) 

(103) 

(104) 
(105) 
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Similarly, we can evaluate the in-product between \B^) r^B^) b,c and 

\ B m,n)R,B\ B m,n)A t C as foUoWS: 

( B m,nR,B- B m,nA,c\ B ^jR,A- B i^jB,c) (106) 
3 

= ^2 Ho,nHp :n H l jH kJ (o,o®m,p,p®rn\l 1 k,l®i,k®i) (107) 

o,p,l,k=0 
3 

= ^ H on Hp n HijH k j5 j5 ^ m ^p^i^p(Srn,k®i (108) 
o,p,l,k=0 
3 

= '^^Hi eiijn H[ )n Hi (Bm jHij (109) 

1=0 
4-1 

= ^H ijn Hi jn Hi tn H m jHijHij (HO) 

= Hi tn .H m j (HI) 

Note that this defines a unitary transformation, since the states \B^j) R ^\B^j)B,c and 
\ B m n)R,B\ B m n) a,c are bases of the space that is invariant or symmetric (eigenvalues +) 
under the permutations Pi and Pj (i,j=0,l,2,3). Now that we know the in-products between 
these states, it is very easy to derive the following relation: 

3 3 

\^)r,A,B,C— ^2 am ' n \ B m,n)R,A\ B m,n)B,C = Ki,n \B%,n) R^B^^) A ,C (H2) 

m,n=0 m,n=Q 

where a m)Tl and b m , n are two (complex) amplitude functions that are dual under a Hadamard 
transform (which generalizes the dual relation Eq. (|5jl): 

3 

bm,n ^ ^ B\ m yH n x d X y (113) 
x,y=0 
3 

^m,n ^ ^ H m yH n x b X y (114) 
x,j/=0 

Also the error operators, which for the Fourier doner are defined as: 

3 

U^ n = 2j2F k ,n\k + m)(k\ (115) 

fc=0 

are redefined as: 

3 

Ul n = 2j2H k , n \k®m}(k\ (116) 

k=0 
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With these new definitions, the analysis of the cloner is analogous to the treatment of 
the cloner presented in Sec. IVI Al and in 0, 0, 3| . The reduced density operator the two 
clones are: 



PA = ^Om.nl^.nXV'm.nl 
m,n 

PB = X) WlV£n>W,J 



with 



H I 

m,n I 



The fidelities and disturbances are given by Eq. (fTBj) and JEc 
cloner will have the same amplitudes as in Sec. IVI Al and 
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\ 



(117) 
(118) 

(119) 

Therefore, the optimal 
where 



(120) 



x y y y 
y z z z 
y z z z 
\y z z z ) 

With these amplitudes, the state of Eq. ()112|) is the optimal state that clones the com- 
putational and the Hadamard bases equally well. 

The reduced state obtained after tracing over Eve's degrees of freedom exhibits no corre- 
lations when it is measured by Alice and Bob in non-correlated bases, so that it is impossible 
for them to establish the difference between this state and an unbiased noise. 

The corresponding maximal admissible error rate (when attacks based on state- 
independent doners are considered) can be shown as before to be equal to Ea = 1 — Fa = 
|(1 — = 25.00% (see Ref. 0, |y]). According to Csiszar and Korner theorem [l^. the 
quantum cryptographic protocol above ceases to generate secret key bits precisely at this 
point, where Eve's information matches Bob's information. 



VII. CONCLUSION AND COMMENTS 



In this paper we investigated state dependent doners that are suited to clone four-level 
systems (quartits). We have adapted the cloning formalism of N.Cerf in such a way 

that it is covariant under certain unitary transformations. We have used this protocol to 



24 



clone the states of two quartit bases that are related through a double Hadamard transform. 
Our results show that the protocol is not suited to clone such states, since the cloning state 
uses 'Fourier' Bell states which have different symmetries than the Hadamard bases that 
we want to clone. Therefore, we redefined the Bell states in such a way that they have the 
same symmetries as the states that we want to clone. The result is a doner that clones 
the Hadamard bases equally well as the 'Fourier' doner clones Fourier bases. Note that the 
approach is suited for an attack on all protocols that use Hadamard bases to encode the 
information as in Ref. 10, 23^ . 

The question remains open whether better cloning machines exist. The safety of quantum 
cryptographic protocols depends crucially on the answer. It is out of the scope of the present 
paper to provide a definitive answer to this question, but it is worth mentioning that in the 
qubit (N—2) and qutrit (N=3) cases, the properties (optimal fidelity, upper bound on the 
error rate and so on) of the doners derived in the literature following Cerf 's approach ^, (| 
2l| are equivalent to those obtained following more general approaches 



Many constraints have to be fulfilled when Eve replaces the maximally entangled state 
shared by Alice and Bob by a clone: the clone must mimic the unbiased noise that would 
be observed by Alice and Bob in the absence of a spy. Therefore it must be independent 
on the basis of detection and on which state is detected among such a basis. Moreover it 
must mimic the correlations between different bases that would be observed in the presence 
of unbiased noise. 

It is our belief that the present, constructive, approach, based on the intrinsic symmetries 
of the protocols under study, provides the most dangerous attack, taking account of all the 
constraints of the problem. 
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ice. This indeed shows that sending to Bob, or using the maximally entangled state, is 
equivalent for what concerns cloning. 

[29] Consider the extreme case that ao,o = 1 and the other a m ^ n = 0. The first clone would in this 
case be perfect, with a fidelity of 1 and no disturbances (Dj = 0). The second clone would, 
however, be characterized by b m ^ n = -k for all values of m and n, leading to fidelities and 
disturbances F = D, L = jr. This basically means that all values have an equal probability 
to be measured, independent of the value that was sent, making the clone worthless, as the 
transinformation between Alice and Bob is indeed 0. 

[30] This choice is unique up to arbitrary unitary transformations in the iV 2 dimensional Hilbert 
space assigned to Eve (B and C) 

[31] Of course this choice was not random. It was shown [j], [2^ that such a matrix clones all 
the states that belong to the two Fourier bases with the same fidelity. However there is no 
guarantee that there are no other matrices which have this property. If we demand covariance 
of the doner state, we have the assurance that (|70|) is the only solution. 
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